315 results · Clear filters · Feed
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.3
Moodle has a Hidden Functionality vulnerability
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
-
Medium 6.1
Moodle: reflected xss risk in some returnurl parameters
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's…
-
Medium 6.1
Moodle: reflected xss risk in blog search
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in co…
-
Medium 5.4
Moodle stored-XSS vulnerability in some "social" user profile fields
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context…
-
Medium 5.4
Cross-Site Request Forgery in Moodle
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote at…
-
Medium 6.1
Moodle reflected cross-site scripting vulnerability in policy tool
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML …
-
Medium 4.3
Moodle No groups filtering in H5P activity attempts report
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS…
-
Medium 6.1
Moodle reflected XSS Vulnerability
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.
-
Medium 5.4
Moodle XSS Vulnerability
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting.
-
Medium 6.1CVE-2022-35653 Scanner template
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrar…
-
Medium 6.1
Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/d…
-
Medium 6.1
Moodle Stored XSS and blind SSRF possible via SCORM track details
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and s…
-
Medium 4.3
Exposure of Sensitive Information in moodle
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
-
Medium 5.3
External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
-
Medium 5.4
Cross-site Scripting in moodle
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
-
Medium 4.3
Missing authorization in Moodle
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
-
Medium 4.3
Improper Authentication in moodle
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
-
Medium 5.3
Moodle Information Disclosure vulnerability
It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
-
Medium 5.4
Moodle stored Cross-site Scripting
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.
-
Medium 6.1CVE-2021-32478 Scanner template
Moodle reflected XSS
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.
-
Medium 4.3
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport…
-
Medium 4.3
Moodle Improper Authentication
A session hijack risk was identified in the Shibboleth authentication plugin.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
-
Medium 4.3
Moodle Incorrect Authorization
Insufficient capability checks made it possible for teachers to download users outside of their courses.
-
Medium 6.5
Moodle type juggling vulnerability
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
-
Medium 4.9
Moodle Improper Encoding or Escaping of Output
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
-
Medium 5.3
Moodle Insecure direct object reference (IDOR) in a calendar web service
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
-
Medium 6.1
Cross-site Scripting in moodle
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
-
Medium 5.4
Moodle Cross Site Scripting (XSS)
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
-
Medium 4.3
Missing permission check in Moodle
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.3
Moodle Bypass email verification secret when confirming account registration
When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.3
Moodle allowed some users without permission to view other users' full names
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.4
Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle
Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.4
Moodle contains Stored XSS via ID number user profile field
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
-
Medium 5.3
Moodle Client side denial of service via personal message
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.